From dfef38022a6ef46916f67bd33274ddb9d7b7ee08 Mon Sep 17 00:00:00 2001
From: Haidar <16521522@mahasiswa.itb.ac.id>
Date: Thu, 16 Nov 2023 05:57:27 +0700
Subject: [PATCH] feat: prevent sql injection
---
api/auth/Login.php | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/api/auth/Login.php b/api/auth/Login.php
index 8e4dd3e..19b08b9 100644
--- a/api/auth/Login.php
+++ b/api/auth/Login.php
@@ -5,18 +5,20 @@ include "../../config/config.php";
include "../../app/core/database.php";
$key = "mahasiswa_leveling";
-
$username = $_POST['username'];
-$uen_password = $_POST['password'];
-$password = openssl_encrypt($uen_password, "AES-256-CBC", $key, 0, substr(md5($key), 0, 16));
-
+$password = $_POST['password'];
+// $password = openssl_encrypt($uen_password, "AES-256-CBC", $key, 0, substr(md5($key), 0, 16));
$conn = Database::getInstance();
+$query = "SELECT * FROM users WHERE username = ?";
+$stmt = $conn->prepare($query);
+$stmt->bind_param("s", $username);
+$stmt->execute();
+$result = $stmt->get_result();
+$data = $result->fetch_assoc();
+$hashPassword = $data['password'];
-$result = $conn->query("SELECT * FROM users WHERE username = '$username' AND password = '$password'");
-
-if ($result->num_rows > 0) {
+if (password_verify($password, $hashPassword)) {
$_SESSION['username'] = $username; // Menyimpan username dalam sesi
- $data = $result->fetch_assoc();
$_SESSION['isAdmin'] = $data['isAdmin']; // Menyimpan isAdmin dalam sesi
echo 'success';
} else {
--
GitLab